*** pcap-bpf.c	1998/02/15 23:35:23	1.30
--- pcap-bpf.c	2000/01/26 23:20:35	1.32
***************
*** 159,165 ****
  	int fd;
  	struct ifreq ifr;
  	struct bpf_version bv;
! 	u_int v;
  	pcap_t *p;
  
  	p = (pcap_t *)malloc(sizeof(*p));
--- 166,172 ----
  	int fd;
  	struct ifreq ifr;
  	struct bpf_version bv;
! 	u_int v, n;
  	pcap_t *p;
  
  	p = (pcap_t *)malloc(sizeof(*p));
***************
*** 184,196 ****
  		sprintf(ebuf, "kernel bpf filter out of date");
  		goto bad;
  	}
! 	v = 32768;	/* XXX this should be a user-accessible hook */
! 	/* Ignore the return value - this is because the call fails on
! 	 * BPF systems that don't have kernel malloc.  And if the call
! 	 * fails, it's no big deal, we just continue to use the standard
! 	 * buffer size.
  	 */
! 	(void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
  
  	(void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
  	if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
--- 191,211 ----
  		sprintf(ebuf, "kernel bpf filter out of date");
  		goto bad;
  	}
! 
! 	/*
! 	 * The bpf buffer length typically defaults to 4k. Check to see
! 	 * what it is and if it's not larger than 32k, try to raise it.
  	 */
! 	n = 32768;	/* XXX this should be a user-accessible hook */
! 	if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) >= 0 && v < n) {
! 		/*
! 		 * Ignore the return value - this is because the call
! 		 * fails on BPF systems that don't have kernel malloc.
! 		 * And if the call fails, it's no big deal, we just
! 		 * continue to use the standard buffer size.
! 		 */
! 		(void) ioctl(fd, BIOCSBLEN, (caddr_t)&n);
! 	}
  
  	(void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
  	if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {